Skip to main content

Governing MCP Tools

MCP introduces significant power. An MCP server can:

success
  • Create files
  • Modify code
  • Query databases
  • Create pull requests
  • Execute workflows

But also:

danger
  • Delete files
  • Modify production infrastructure
  • Have unlimited access to repositories
  • Have unrestricted access to environments and systems
  • etc...

This power requires governance.

Questions organizations must answer:

  • Which MCP servers are approved?
  • Which actions are allowed?
  • Which actions require approval?
  • Which repositories can be modified?
  • Which environments can be accessed?
info

Governance becomes essential.

Mini Exercise​

Write one approval rule for an MCP tool with high impact.

Example​

An MCP tool that modifies production infrastructure should require human approval before any action is executed.